Other nomination

DNS Analyzer - Finding DNS vulnerabilities with Burp Suite

Timo Longin · SEC Consult

A Burp Suite extension that uses Burp Collaborator interactions to measure the UDP source port and DNS ID randomness of the resolver a web application uses, flagging resolvers still predictable enough for a Kaminsky cache-poisoning attack. An attacker who poisons such a resolver can redirect password-reset mail and take over accounts.

Record

Researcher

Timo Longin

Published by

SEC Consult

In the archive

• Nominated for the 2023 Top 10 Web Hacking Techniques

Related sources

• DNS Analyzer extension
• Earlier DNS analysis server
• Research prerequisite
• Research prerequisite

Tags

• cache-poisoning
• dns
• tooling
• auth-bypass
• email
• detection
• bug-bounty
• owasp-a01-2021
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of Timo Longin, first published at the original source. Preserved copies are kept so the citation survives its host.